Security researchers have uncovered what appears to be a sophisticated targeted attack launched from India and designed to steal information from a range of government and private enterprise victims in Pakistan, China and elsewhere.

What began as an investigation into an attack on Norwegian operator Telenor soon uncovered evidence to show attackers probably hailing from India had been lifting info from business, government, poltical organisations for as long as three years.

Norwegian anti-malware firm Norman AS claimed in its Operation Hangover (PDF) report that although the attack infrastructure appeared â€œpredominantly to be a platform for surveillance against targets of national security interest (such as Pakistan)â€, as well as industrial espionage, there is no direct evidence to link it to state-sponsored players.

Finding readable folders on a number of C&C servers, the researchers dug deeper to discover several malicious executable digitally signed with a certificate which had been revoked in 2011.

Domains registered by the attackers were almost all privacy protected, while â€œalmost all websites belonging to this attacker has their robots.txt set to â€˜disallowâ€™ to stop them from being crawledâ€, the report continued.

However, the attack is far from advanced, according to security firm Eset, which has also been investigating.

"String obfuscation using simple rotation (a shift cipher), no cryptography used in network communication, persistence achieved through the startup menu and use of existing, publicly-available tools to gather information on infected systems shows that the attackers did not go to great lengths to cover their tracks," the vendor said in a blog post.

The researchers at Norman explained how the initial Telenor attack allowed them to widen the investigation, as follows:

We have direct knowledge of only one attack â€“ the one against Telenor. During this investigation we have obtained malware samples and decoy documents that have provided indications as to whom else would be in the target groups. We have observed the usage of peculiar domain names that are remarkably similar to existing legitimate domains. We have also obtained sinkhole data for a number of domains in question and found open folders with stolen user data in them; enough to identify targets down to IP and machine name/domain level.

These IP addresses hail from a large range of countries globally including China, Russia, France and the US but the vast majority correspond to Pakistan.

â€œThe continued targeting of Pakistani interests and origins suggested that the attacker was of Indian origin,â€ the report concludes.

Interestingly, an analysis of the project paths for malware creation revealed a highly organised operation in which â€œmultiple developers are tasked with specific malware deliverancesâ€:

There are many diverging project paths which points towards different persons working on separate sub-projects, but apparently not using a centralised source control system. The projects seem to be delegated into tasks, of which some seem to follow a monthly cycle.

The report also points out that the word â€œAppinâ€ crops up in various contexts and cases, including malware file names, speculating some actor may be deliberately trying to implicate Indian security company Appin Security Group in the attacks.

The company has now issued a warning notice on its home page urging the public â€œnot to be misled by any communication received through fictitious domains which are purportedly being made by, or on behalf of, our companyâ€.

It also sent a strongly worded statement to The Hacker News claiming the reference to Appin in the report was a â€œmarketing gimmick on the part of Norman ASâ€ and that it has already initiated legal proceedings against the Norwegian firm. Â®

Security researchers have uncovered what appears to be a sophisticated targeted attack launched from India and designed to steal information from a range of government and private enterprise victims in Pakistan, China and elsewhere.

It could even have been engineered by your country to implicate India. After all, China has been hacking US websites for past 10 years now. Easy for them to hack themselves and obfuscate the IP address to point towards India.